I've got a python script that launches tshark and then uses tcpreplay to inject packets onto a small network. After tshark stops capturing and writes a pcap to disk, I attempt to use another tshark call to translate that capture to text for parsing. This last bit doesn't work. I see 'tshark: Unrecognized libpcap format' on screen. Code looks like this:

# Capture and Translate calls for tshark
tsharkCapture =  shlex.split("tshark -a duration:%s -i %s -F libpcap -w %s" % (10, "eth0", "result.pcap"))
tsharkTranslate = shlex.split("tshark -i - -V")
Replay call for tcpreplay
tcpreplayCall = shlex.split("tcpreplay –intf1 %s –enable-file-cache –timer=gtod –quiet –loop=%s –pps=%s %s" % ("eth0", 1, 1, "replay.pcap"))
start up tshark to generate a pcap file, which will (hopefully!) hold the relevant traffic
tsharkProc = subprocess.Popen(tsharkCapture, bufsize=0)
snooze a bit, launch the replay file
time.sleep(1)
tcpreplayProc = subprocess.Popen(tcpreplayCall)
wait for the tshark capture process to terminate
tsharkProc.poll()
while tsharkProc.returncode == None:
time.sleep(0.1)
tsharkProc.poll()
translate the pcap capture to a txt file
tsharkProc = subprocess.Popen(tsharkTranslate,
stdin=open("result.pcap", "rb"),
stdout=open("result.txt", "wb"))
wait for the translation process to terminate
tsharkProc.poll()
while tsharkProc.returncode == None:
time.sleep(0.1)
tsharkProc.poll()

The calls themselves appear correct. Tshark captures, tcpreplay replays ‘replay.pcap’, tshark writes ‘result.pcap’ to file, and this file contains what it should. ‘result.txt’ is empty however.

If (just to see) I replace ‘result.pcap’ with ‘replay.pcap’ in the translate call, there is no error, and ‘result.txt’ has what I expect. If I comment out the replay launch (with ‘result.pcap’ in the translate call), there is again no error, and ‘result.txt’ has what I would expect.

It really looks like the issue is with running tshark, then tcpreplay, and finally tshark to translate to text–all those things together.

I would be happy to have the first tshark call write the ‘result.txt’ file directly rather than using a second call to write it out, but I haven’t had luck with that either.

I can open ‘result.pcap’ with Wireshark and export the file to text without any issues.

FYI ‘replay.pcap’ is generated using text2pcap, from this:

0000  00 40 ae 00 47 e3 00 02 b3 11 11 11 00 14 82 82  End
0010  03 01 04 02 73 21 0e 0c 02 00 21 98 1e 09 4c 19  End
0020  00 1f                                            End

What am I doing wrong?